The vulnerability arises from a logic error in how Cisco Secure Firewall Threat Defense integrates Snort 2 and Snort 3 deep packet inspection rules. An attacker can craft packets that trigger different Snort rule sets for the outer and inner connections, causing the engine to misclassify traffic that should be dropped. The result is that unwanted traffic can enter the protected network, potentially exposing sensitive data or facilitating further attacks.

Cisco Secure Firewall Threat Defense (FTD) Software is impacted. All installations that use Snort 2 or Snort 3 for deep inspection within the FTD product are susceptible, regardless of version, unless a subsequent patch has been applied.

The CVSS score of 5.8 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the lack of listing in the CISA KEV catalog further indicates low external exploitation pressure. The flaw is exploitable remotely by an unauthenticated attacker who can send crafted traffic. Successful exploitation allows traffic that should be denied to pass through to the internal network.